[CVE-2021-38300] Linux kernel cBPF JIT compiler for MIPS emits incorrect branches leading to execution of arbitrary Kernel code

[Piotr Krysiuk <piotras () gmail com>]

An issue has been discovered in the Linux kernel that can be abused by
unprivileged local users to escalate privileges.

The issue is with how the cBPF JIT compiler for MIPS generates branch
instructions. The conditional branch instructions on MIPS use 18-bit
signed offsets allowing for a branch range of 128 KBytes (backward and
forward). However, this limit is not observed by the cBPF JIT compiler,
and so the JIT compiler emits out-of-range branches when translating
certain cBPF programs. This can be abused to craft anomalous machine
code, where the control flow is hijacked to execute arbitrary Kernel
code. Such machine code may be crafted and executed by unprivileged
local users.

I developed a PoC that demonstrates code execution in Kernel mode by
unprivileged local users via setsockopt().

Note that the recently introduced BPF_UNPRIV_DEFAULT_OFF is not
effective against issues in cBPF, including this one.

The issue has been reported to security () kernel org and included two
alternative patch proposals. The kernel maintainers picked one of the
proposed patches and suggested to send it to the BPF subsystem public
mailing list, before it can be merged into the BPF subsystem public git
repository.

The patch is currently available from:
* https://lore.kernel.org/bpf/20210915160437.4080-1-piotras () gmail com/

# Discoverer

Piotr Krysiuk <piotras () gmail com>

# References

CVE-2021-38300 (reserved via https://cveform.mitre.org/)